[blackorzar]

Instead of CLA you may consider on requiring the contributions to be dual licensed MIT + AGPL. MIT allows you to use the code in your SAAS version. Your code, the constributions and the entire repo can be kept AGPL only (because MIT doesn't impose a condition on you to release the entire code as MIT).

[ahnick]

If someone contributes back to the repo is that contribution governed by both the MIT and AGPL licenses in a dual license scenario?

[teddyh]

Not necessarily, but that is always true, even for, e.g., GPL-only projects. I.e. a GPL-only project might recieve a patch, but if the patched code does not contain a license covering that patch, the project does not have a licence to the patch and cannot use it. The usual way this is fixed is by having clear descriptions in your developer’s documentation on how to contribute patches and what licenses must be given to recipients in order for you, the software maintainers, to accept the patch into the project.

See further this post:

https://sfconservancy.org/blog/2014/jun/09/do-not-need-cla/